b13/assetcollector

b13/assetcollector 4.1.2 appears to be a healthy dependency: it has a long release history dating back to 2019, six releases in the last 12 months, a stable non-prerelease version, active recent repository work, two active maintainers, organization backing, tests, a clear README, and a matching source repository. The package is licensed and has no install-time lifecycle scripts or registry deprecation. The main reservations are the absence of repository security scanning and an explicit security policy, plus workflows without top-level token permissions; these are supply-chain hygiene gaps but are partly offset by the absence of detected dangerous workflow patterns. Popularity is modest, so adoption should still consider the package's relatively small community footprint.

Latest 4.1.2

Packagist

88%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo issue activity

There are four open issues and no new or closed issues in the last month, although one pull request was merged; this suggests limited recent issue throughput but not clear abandonment.

Repo popularity

The repository has modest popularity with 10 stars, zero forks, and seven watchers. This limits community corroboration somewhat, but popularity is supporting evidence and does not outweigh the stronger maintenance signals.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. This is a security-process gap, though it does not by itself indicate poor package health.

Security policy

No repository security policy was found, reducing transparency around vulnerability reporting and response procedures.

Token permissions

Both workflows lack top-level token permission declarations, which weakens least-privilege CI hygiene; however, no workflow was found to request top-level write permissions.